 Willi Ballenthin
|
05ee3df679
|
update scope syntax
|
2023-10-17 11:34:31 +00:00 |
|
|
Willi Ballenthin
|
9cb8848b03
|
Merge branch 'master' into dynamic-syntax
|
2023-10-17 10:29:30 +00:00 |
|
|
Moritz
|
a39a2c0b52
|
Merge branch 'master' into update-alloc-rules
|
2023-10-11 12:03:42 +02:00 |
|
|
mr-tz
|
66f58dffa0
|
update match rule name
|
2023-10-11 11:20:23 +02:00 |
|
|
mr-tz
|
5f223ea5ce
|
rename rules
|
2023-10-11 11:17:13 +02:00 |
|
|
mr-tz
|
ed791c9b17
|
separate allocate and change memory protection
|
2023-10-11 11:14:14 +02:00 |
|
|
Mike Hunhoff
|
2a37df98f5
|
adding new rules based on private Linux sample(s) (#821)
* adding new rules based on private Linux sample(s)
---------
Co-authored-by: Moritz <mr-tz@users.noreply.github.com>
|
2023-10-09 18:27:33 +02:00 |
|
|
johnk3r
|
b33f95c9ca
|
set state tcp connection (#829)
* Add rule
---------
Co-authored-by: Willi Ballenthin <wballenthin@google.com>
|
2023-10-06 17:19:47 +02:00 |
|
|
ryan
|
6fbf5187e5
|
Update Mappings for MBC (part 11)
|
2023-09-27 15:01:03 -04:00 |
|
|
Yacine Elhamer
|
d20a7e0a48
|
add elaborative comment
|
2023-08-29 21:32:37 +02:00 |
|
|
Yacine Elhamer
|
d5f05f4e88
|
initial commit
|
2023-08-29 21:23:55 +02:00 |
|
|
Yacine Elhamer
|
5b73ddcd24
|
manual pass
|
2023-08-22 09:40:13 +02:00 |
|
|
Yacine Elhamer
|
0aea484e04
|
updated rules
|
2023-08-21 19:14:45 +02:00 |
|
|
Yacine Elhamer
|
3a42318eae
|
fix improper scope for rules containing a subscope in and
|
2023-08-21 14:33:12 +02:00 |
|
|
Yacine Elhamer
|
c4cdd9bae7
|
fix improper scope for rules containing a subscope in and
|
2023-08-21 14:27:45 +02:00 |
|
|
Yacine Elhamer
|
a55d769da8
|
fix author quoting
|
2023-08-21 09:10:33 +02:00 |
|
|
Yacine Elhamer
|
8d851f3343
|
updated rules
|
2023-08-20 15:39:29 +02:00 |
|
|
mr-tz
|
64d3a359d3
|
fix example function address
|
2023-08-19 11:27:55 +02:00 |
|
|
Yacine Elhamer
|
850909bd82
|
update
|
2023-08-17 11:07:02 +02:00 |
|
|
Yacine Elhamer
|
e937af1ee6
|
initial commit
|
2023-08-17 10:41:11 +02:00 |
|
|
jtothej
|
39fa528601
|
Add get-uefi-variable.yml and set-uefi-variable.yml
|
2023-08-02 18:21:12 +08:00 |
|
|
Willi Ballenthin
|
fd6cd94bee
|
graduate get windows directory from kuser_shared data
|
2023-07-13 04:10:07 +02:00 |
|
|
Willi Ballenthin
|
3a483a931c
|
Merge pull request #778 from jaxxpnd/jaxxpnd-enum-minifilter
Create enumerate-minifilter-drivers.yml
|
2023-07-12 11:01:34 +02:00 |
|
|
Willi Ballenthin
|
c5ca71cca2
|
Merge pull request #789 from jtothej/windowsc
Add inject-shellcode-using-extra-window-memory.yml and inject-shellco…
|
2023-07-12 11:00:04 +02:00 |
|
|
Moritz
|
bfec062781
|
Merge pull request #777 from mandiant/rules52-25
query service configuration
|
2023-07-08 09:53:00 +02:00 |
|
|
Moritz
|
4d5d6f9784
|
Merge pull request #786 from jtothej/switchdesktop
Add switch-active-desktop.yml
|
2023-07-07 08:26:07 +02:00 |
|
|
jtothej
|
f99fd950b6
|
Update switch-active-desktop.yml and move to host-interaction/gui
|
2023-07-06 21:21:07 +08:00 |
|
|
JJ
|
1d6c6cbc56
|
Update host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
|
2023-07-06 18:56:09 +08:00 |
|
|
jtothej
|
fb55d37726
|
Add inject-shellcode-using-extra-window-memory.yml and inject-shellcode-using-window-subclass-procedure.yml
|
2023-07-06 16:19:40 +08:00 |
|
|
jtothej
|
f8dfe8ec16
|
Add create-new-application-domain-in-dotnet.yml
|
2023-07-05 18:51:38 +08:00 |
|
|
JJ
|
65b07e2b5c
|
Add create-virtual-file-system-in-dotnet.yml (#783)
* Add create-virtual-file-system-in-dotnet.yml
|
2023-07-05 08:40:46 +02:00 |
|
|
mr-tz
|
83d4e3bc02
|
add import
|
2023-07-02 16:23:04 +02:00 |
|
|
Moritz
|
21077c2908
|
revert MBC
E1055.004 cannot be validated at the moment
|
2023-06-28 07:50:07 +02:00 |
|
|
jaxxpnd
|
5d091eeb24
|
Create enumerate-minifilter-drivers.yml
Moved rule to enumerate minifilter drivers from anti-analysis/anti-av to host-interaction/filter, added sample to test samples repository
|
2023-06-25 13:50:43 +03:00 |
|
|
Moritz
|
d5c67ab0f4
|
Merge pull request #774 from mandiant/rules52-24
Update CLSID and add two service-related rules
|
2023-06-24 10:20:50 +02:00 |
|
|
mr-tz
|
ce1e11d838
|
add rule
|
2023-06-24 10:19:11 +02:00 |
|
|
ryan
|
153d4c0d2c
|
Update Mappings for MBC
|
2023-06-21 10:45:01 -04:00 |
|
|
mr-tz
|
0929c9cdb5
|
tighten rule via basic block subscope
|
2023-06-16 17:40:18 +02:00 |
|
|
mr-tz
|
70018d2fba
|
add rule
|
2023-06-16 16:32:08 +02:00 |
|
|
Moritz
|
62598dde90
|
Merge pull request #763 from mandiant/rules52-21
Improve clipboard rules
|
2023-06-12 14:27:48 +02:00 |
|
|
Moritz
|
1ecaa98de4
|
Merge pull request #769 from mandiant/rules52-22
Add LZ* functions
|
2023-06-12 14:17:56 +02:00 |
|
|
mr-tz
|
2fc3bf5639
|
tighten scope and add optional loop match
|
2023-06-12 14:16:41 +02:00 |
|
|
mr-tz
|
2fb30cee11
|
add rule
|
2023-06-10 14:03:48 +02:00 |
|
|
mr-tz
|
a8e9c6cfd0
|
add LZ* functions
|
2023-06-04 12:16:30 +02:00 |
|
|
mr-tz
|
aad07996a7
|
improve clipboard rules
|
2023-05-26 11:14:57 +02:00 |
|
|
mr-tz
|
dbeab1fe46
|
match on create or open file library rule
|
2023-05-12 12:19:48 +02:00 |
|
|
Blas
|
7f88ed43f7
|
Update after testing with sample
|
2023-05-01 12:47:16 -04:00 |
|
|
Blas
|
f7cbc1f12d
|
Update reference-absolute-stream-path-on-windows.yml
|
2023-04-26 14:04:03 -04:00 |
|
|
Moritz
|
0ae4cda9dc
|
Update read-clipboard-data.yml
|
2023-03-23 21:33:54 +01:00 |
|
|
Mike Hunhoff
|
8310355528
|
update rule documentation and improve .NET detection for OS gather (#724)
* add documentation for property feature and .NET constructors
* add API to detect OS version read in .NET
* fix capitalization of Windows
|
2023-03-16 17:40:48 +00:00 |
|